Bug 1857318 (CVE-2015-8608)

Summary:	CVE-2015-8608 perl: out-of-bounds read and buffer overflow in functions VDir::MapPathA and VDir::MapPathW via a crafted drive letter or a pInName argument
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	caillon+fedoraproject, iarnell, jplesnik, kasal, mmaslano, perl-devel, perl-maint-list, ppisar, psabata, rhughes, sandmann, spotrh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	perl 5.24.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-07-16 05:16:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1857319

Description Guilherme de Almeida Suckevicz 2020-07-15 16:37:02 UTC

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

Reference:
https://rt.perl.org/Public/Bug/Display.html?id=126755

Comment 1 Huzaifa S. Sidhpurwala 2020-07-16 05:13:52 UTC

Upstream commit: https://github.com/Perl/perl5/commit/52236464559c6e410a4587d3c6da9639e75f3ec1#diff-31982a731a0996d0cc82a4ad4e70ad50

Comment 2 Huzaifa S. Sidhpurwala 2020-07-16 05:16:51 UTC

This is a Microsoft Windows only flaw in perl as mentioned in the original report at: https://github.com/Perl/perl5/issues/15067#issuecomment-544077033

Comment 3 Huzaifa S. Sidhpurwala 2020-07-16 05:16:57 UTC

Statement:

This is a Microsoft Windows only flaw in perl as mentioned in the original report at: https://github.com/Perl/perl5/issues/15067#issuecomment-544077033